diff --git a/docs/PLATFORM-OPERATIONS-SPEC.md b/docs/PLATFORM-OPERATIONS-SPEC.md
index 9de3a50..018fb7c 100644
--- a/docs/PLATFORM-OPERATIONS-SPEC.md
+++ b/docs/PLATFORM-OPERATIONS-SPEC.md
@@ -133,6 +133,7 @@ Nginx is the only public application entry point. The worker is event-driven and
 | `redis` | Queue, cache, rate-limit, replay coordination | `data` | named AOF volume, excluded from backup | none |
 | `migrate` | Versioned schema migration | `data` | none | one-off only |
 | `import` | One-time CSV bootstrap/recovery | `data` | exact read-only input bind | one-off profile only |
+| `calendar` | Reviewed catalog bootstrap with audited state transitions | `data` | reviewed read-only JSON bind | one-off profile only |
 | `admin` | Demo credentials and approved maintenance | `data` | explicit output bind if requested | one-off profile only |
 
 Post-MVP adds `prometheus`, `grafana`, and approved exporters on a separate private monitoring network. Grafana binds only to loopback/private operator access unless a later ADR approves a protected public route.
@@ -238,7 +239,7 @@ Compose health/dependency conditions prevent common startup races, but the manua
 ### One-time CSV import
 
 - Import is an explicit operator command/profile, never normal startup, cron, a scheduler, watcher, or deploy trigger.
-- On the first server release only, tracked `scripts/first-start.sh` orchestrates PostgreSQL/Redis readiness, the one-off migration, the importer profile, reconciliation, and then public application startup. Later ordinary deploys/restarts never invoke it.
+- On the first server release only, tracked `scripts/first-start.sh` orchestrates PostgreSQL/Redis readiness, the one-off migration, the importer profile, reconciliation, reviewed calendar bootstrap, and then public application startup. Later ordinary deploys/restarts never invoke it.
 - The operator provides an exact resolved path outside Git; only that file is mounted read-only.
 - Import cannot overlap restore, backup, or another import and starts only after migration succeeds.
 - The backend importer pins the approved checksum/schema/filename/counts, enforces resource caps, streams data, reconciles counts, removes temporary raw staging, and records incomplete failure safely according to the approved backend import specifications.